topic Re: Time-based Radius CoA dynamic trigger in Network Access Control

Time-based Radius CoA dynamic trigger

pwlau — Wed, 29 Nov 2017 07:49:38 GMT

Hi,

How do I achieve the below use cases with ISE and Wireless?

Only allow access to the network from 9am – 6pm, and disconnect any “active” clients after 6pm?
Assign a Radius av-pair AIrespace-QoS-Level to clients who authenticate from 9am-6pm, but assigned a new av-pair AIrespace-QoS-Level to any “active” client after 6pm?

Can both use-cases be achieved via RADIUS CoA triggered based on time of day?

Is there such way to configure this without resorting to using Python scripts for API calls?

Clearpass seem to be able to do this by changing the user-role of active connected clients at certain time of day, with CoA.

Regards,

Steven

Re: Time-based Radius CoA dynamic trigger

ognyan.totev — Wed, 29 Nov 2017 07:57:05 GMT

I think you need Time and Date conditions but i never tested .

Re: Time-based Radius CoA dynamic trigger

pwlau — Wed, 29 Nov 2017 08:20:08 GMT

Hi,

Time and Condition on Authorization Profile will be enforced for new connections/clients and not existing clients.

If the existing client is still connected to the network, the only way to assign a new Authorization Profile to them is via Change of Authorization, to force re-authentication.

However, I couldn't figure out how to trigger this event, without using a API call script.

Re: Time-based Radius CoA dynamic trigger

ognyan.totev — Wed, 29 Nov 2017 08:30:45 GMT

I think you can set timers for re-authentications In authorization profiles. I think this will trigger the COA.And if match with new rule it will be applied.

Re: Time-based Radius CoA dynamic trigger

pwlau — Wed, 29 Nov 2017 08:50:01 GMT

Is there a way to set this Re-authentication timer to reauthenticate clients at 6pm?

This is because different clients might join the network at different time of day within the 9am-6pm window.
It'll be a challenge to figure out the exact timer for the action.

Re: Time-based Radius CoA dynamic trigger

Jason Kunst — Wed, 29 Nov 2017 12:34:59 GMT

No, would recommend setting reauth timer for 30 min perhaps so they get reauth close to the 6pm mark but not going to be exact

Or look at shutting wlan at a certain time via prime

Re: Time-based Radius CoA dynamic trigger

pwlau — Wed, 29 Nov 2017 12:56:49 GMT

Shutting wlan off will not address the 2nd use case.

Which is to reassign a new qos profile to the active user after office hours, so the user will enjoy an elevated bandwidth contract privilege.

Wouldn't setting reauth timer to 30 mins interval impacts user experience?

Are there no way to auto push CoA to connected clients based on time of day?

Thanks.

Re: Time-based Radius CoA dynamic trigger

Jason Kunst — Wed, 29 Nov 2017 13:07:31 GMT

You could have different rules for different timers

If you access in the morning you could set a 4 hr timer, 2 hour after noon perhaps and as gets closer reduce to 1 hr and then 30 min if absolutely critical

The client shouldn’t see reauths as they are very quick and don’t drop traffic

If you have lots of clients it maybe a lot of load on the system (make sure you are suppressing client authentications (default setting on ISE since 2.0)

As stated before there is no automated feature, please reach out to the ISE-pm team through sales channel for feature requests